Public PoC Released for Apache Superset SQL Injection Vulnerability
A public Python PoC exploit is available for CVE-2026-23980, an authenticated error-based SQL injection in Apache Superset versions before 6.0.0.
CVE-2026-23980 is a SQL injection flaw (CWE-89) in Apache Superset affecting all releases before 6.0.0, exploitable via the sqlExpression and where parameters by authenticated users with read-level access. A public repository containing a Python exploit.py proof-of-concept has been released, reducing attacker effort against exposed instances. Apache disclosed the issue on February 24, 2026 and fixed it in Superset 6.0.0. Defenders should upgrade and monitor logs for malformed queries, database errors, and unusual activity from low-privilege accounts.
- Error-based SQLi via sqlExpression and where parameters reveals query structure and schema
- Requires authenticated read-level access, but read-only users can still probe databases
- PoC exploit.py publicly available, lowering exploitation effort
- Fixed in Apache Superset 6.0.0; upgrade prioritized
- Monitor proxy and app logs for repeated malformed query requests
- CVEs
- CVE-2026-23980
- Vendors
- Apache Software Foundation
- Products
- Apache Superset
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-23980 | Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read… | 5.3 | <1% | PoC |
From the original article
2 min read at cybersecuritynews.com
A public proof-of-concept exploit has been released for CVE-2026-23980, a SQL injection vulnerability affecting Apache Superset versions before 6. 0. 0.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.